PT-2026-55415 · Go · Github.Com/Casdoor/Casdoor

Publicado 2026-05-28 · Atualizado 2026-05-28

OSV

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Casdoor versions 2.362.0 and earlier do not enforce SAML assertion time bounds. The gosaml2 library reports all time-validation results, including NotOnOrAfter and NotBefore, in the assertionInfo.WarningInfo field. However, ParseSamlResponse() never reads this field, meaning that time bounds are computed by the library but silently discarded before the user session is issued.

Correção

Insufficient Session Expiration

Enumeração de Fraquezas

CWE-613

Identificadores relacionados

GHSA-RGQ2-93GJ-FFXG

Produtos afetados

Github.Com/Casdoor/Casdoor

Referências · 4

• https://github.com/casdoor/casdoor · Nota
• https://kb.cert.org/vuls/id/780781 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-9096 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-rgq2-93gj-ffxg · Aviso do Fabricante